Novel Detection Technique of Process Injection using Network Anomalies

The talk opens with why process injection persists and why host-based detection struggles. Techniques such as remote thread creation, API hooking, process hollowing and newer variants can be hidden by evasion methods, and a threat hunter cannot assume every customer runs a capable endpoint product. The speaker argues that a process's network behavior is harder to disguise than its host artifacts.

The method builds a baseline of how each process communicates across many customer networks. Destination ports are grouped into port classes, and only processes seen in at least three networks are kept. Support and confidence measures borrowed from data mining describe how often each process uses each group, and a sliding window compares daily traffic against that history. Common false positives, such as proxies, DNS changes and configured gateway ports, are handled with allow lists and by checking whether the behavior is already normal elsewhere in the network.

In one customer onboarding, five legitimate Windows processes began using SMB, a protocol they had never used before. Investigating scheduled tasks, services and commands led to a script that spread via EternalBlue, tunneled DNS, ran a PowerShell downloader and deployed a Monero miner, which the speaker tied to the WannaMine campaign. Osquery was then used to hunt for the indicators across the network. The takeaway is that outbound network baselines can reveal injected code that host tools miss, and similar logic can apply to services or Sysmon network events.